DL-RLSTM: An Anomaly Detection Framework for High Dimensional Time Series Data

With the development of communication technology and the popularization of Internet of Things (IoT) applications in daily life, anomaly detection for time series data has been paid more attentions. To mitigate the imbalance and incorrectness of data labels in anomaly detection, unsupervised anomaly detection has been widely used to detect abnormal data. Although a number of efforts on unsupervised anomaly detection has been developed, most of these schemes focus on detecting abnormal data with low-dimensional and achieve undulatory efficiency on detecting abnormal data with high-dimension. In addition, most of the existing schemes determine the data as abnormalities with the thresholds defined by expertise experience, resulting in undulatory efficiency on abnormal data detection as well. To address these issues, in our paper, an advanced Double Layer-RLSTM framework, namely DL-RLSTM, is proposed to detect the abnormal time series data with high-dimension effectively. Particularly, two neural network layers are considered in our DL-RLSTM framework, in which the RLSTM network is introduced in the first neural network layer to extract the temporal feature of time series data. The second neural network layer in our DL-RLSTM framework are served as the autoencoder to reconstruct temporal feature of time series data extracted by the first neural network layer. Different from the traditional projection-based dimensionality reduction, our DL-RLSTM framework can maximize the retention of temporal feature of time series data. Additionally, K-Means is introduced in our DL-RLSTM framework to determine the abnormal time series data according to the anomaly scores obtained from the autoencoder. By doing this, the participation of expertise experience on abnormality thresholds determination can be minimized. Via evaluations, the results show that our DL-RLSTM framework can achieve better detection efficiency on high dimensional abnormal time series data in comparison with existing schemes.

I. Introduction

With the rapid development of communication technology, the Internet of Things (IOT) applications gradually occupies an extremely important position in daily life. Due to the large amount of data generation and frequent data interaction, a small amount of abnormal data may lead to the fault of entire IoT systems [1]. Hence, anomaly detection (also known as outlier detection) has received extensive attention to detect abnormal data in IoT systems of several areas, such as financial fraud detection [2], network attack detection [3], sensor anomaly detection [4], [5], etc..